NXbit

NXbit, short for No-Execute bit, is a hardware feature in modern processors that supports data execution prevention by allowing the operating system to mark certain memory pages as non-executable. When a page is flagged as non-executable, the CPU will not fetch and execute instructions from that page, helping to prevent common memory corruption exploits such as buffer overflows from injecting and running code in data regions.

In typical implementations, the operating system manages page permissions in the virtual memory system. Each page table entry contains a flag indicating whether the page is executable. If a program attempts to execute code from a page marked non-executable, the CPU raises an exception, which the OS handles, often terminating the offending process. This mechanism requires both CPU support and corresponding OS-level deployment to be effective.

Origins and adoption: The concept originated with AMD’s No-Execute bit and was adopted by Intel under the Execute Disable naming. The feature has been widely available in consumer hardware since the early 2000s and is a core part of modern memory protection schemes. Major operating systems, including Windows, Linux, and macOS, implement NX/DEP support to varying degrees, often enabling it by default on supported hardware.

Impact and limitations: NXbit provides a strong barrier against many common memory-corruption exploits by preventing execution from data pages such as stacks and heaps. However, it is not a silver bullet: it cannot stop exploits that execute code from legitimate executable regions, code already loaded into executable memory, or attacks that bypass execution checks (for example, return-oriented programming). It also requires hardware support and proper OS configuration, and some legacy systems or certain virtualization scenarios may have limited or configurable NX behavior.